IN THE CLAIMS: 

1 . (Currently amended) A method in a data processing system for handling a 
situation, the method comprising: 

responsive to detecting a situation, selecting an aging function from a plurality of 
aging functions based on the detected situation, and applying an the selected aging 
function to the situation; and 

presenting alerts regarding the situation based on the aging function. 

2. (Currently amended) The method of claim 1, wherein the aging function is a an 
exponential decay function wherein a severity for the detected situation decreases 
exponentially with respect to time if any additional situations of a same type as the 
detected situation are not detected during such time . 

3. (Original) The method of claim 1, wherein the aging function includes a user 

-\ 

settable threshold. 

4. (Currently amended) The method of claim 1, wherein the aging function is an 
increasing time function wherein a severity for the detected situation increases with 
respect to time if any additional situations of a same type as the detected situation are not 
detected during such time . 

5. (Original) The method of claim 4, wherein the increasing time function is one of 
a linear function or an exponential function. 

6. (Currently amended) The method of claim 1, wherein the aging function is a 
decreasing half-life function wherein a severity for the detected situation decreases by 
half after a given time window has elapsed if no additional situations of a same type as 
the detected situation are detected during such time window . 
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7. (Currently amended) The method of claim 6, wher e in the decr e asing function is a 
half life function 1, wherein the aging function is a combination of a linear function and 
an exponential function . 

8. (Original) The method of claim 1, wherein the presenting step comprises: 
displaying the alert on a console. 

9. (Original) The method of claim 1, wherein the situation is one of a denial of 
server, a suspicious Web server request, or an unauthorized access of a server. 

10. (Currently amended) A method in a data processing system for handling a 
situation that includes a set of events , the method comprising: 

monitoring for events; 

responsive to detecting an event, which triggers a the situation, applying an aging 
function to the situation, wherein the aging function is used to identify a severity of the 
situation; and 

presenting an alert for the situation based on the severity of the situation identified 
by the aging function , wherein a threshold at which the situation is triggered is based 
upon a correlation between the set of events . 

1 1 . (Currently amended) The method of claim 1 0, wherein th e situation includes a set 
of events the aging function is selected from a plurality of aging functions based on the 
triggered situation . 

12. (Currently amended) The method of claim 1 1 , wherein the correlation between 
the set of events form a denial of service attack is a severity of each of the events . 

13. (Currently amended) A data processing system comprising: 
a bus system; 

a communications unit connected to the bus system; 
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a memory connected to the bus system, wherein the memory includes a set of 
instructions; and 

a processing unit connected to the bus system, wherein the processing unit 
executes the set of instructions to apply an aging function to the situation in response to 
detecting a situation, and present alerts regarding the situation based on the aging 
function , wherein the aging function is selected from a plurality of aging functions based 
on the detected situation . 

14. (Currently amended) A data processing system for handling a situation, the data 
processing system comprising: 

applying means, responsive to detecting a situation, for selecting an aging 
function from a plurality of aging functions based on the detected situation, and applying 
an the selected aging function to the situation; and 

presenting means for presenting alerts regarding the situation based on the aging 
function. 

15. (Currently amended) The data processing system of claim 14, wherein the aging 
function is a an exponential decay function wherein a severity for the detected situation 
decreases exponentially with respect to time if any additional situations of a same type as 
the detected situation are not detected during such time , 

16. (Original) The data processing system of claim 14, wherein the aging function 
includes a user settable threshold. 

17. (Currently amended) The data processing system of claim 14, wherein the aging 
function is an increasing time function wherein a severity for the detected situation 
increases with respect to time if any additional situations of a same type as the detected 
situation are not detected during such time . 

1 8. (Original) The data processing system of claim 17, wherein the increasing time 
function is one of a linear function or an exponential function. 
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19. (Currently amended) The data processing system of claim 14, wherein the aging 
function is a decreasing half-life function wherein a severity for the detected situation 
decreases by half after a given time window has elapsed if no additional situations of a 
same type as the detected situation are detected during such time window . 

20. (Currently amended) The data processing system of claim 19, wherein the 
decreasing function is a half life function 14, wherein the aging function is a combination 
of a linear function and an exponential function . 

21. (Original) The data processing system of claim 14, wherein the presenting means 
comprises: 

means for displaying the alert on a console. 

22. (Original) The data processing system of claim 14, wherein the situation is one of 
a denial of server, a suspicious Web server request, or an unauthorized access of a server. 

23. (Currently amended) A computer program product in a computer readable 
medium for handling a situation, the computer program product comprising: 

first instructions, responsive to detecting a situation, for selecting an aging 
function from a plurality of aging functions based on the detected situation, and applying 
an the selected aging function to the situation; and 

second instructions for presenting alerts regarding the situation based on the aging 
function. 
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